source4/heimdal/kdc/gss_preauth.c

   1 /*
   2  * Copyright (c) 2021, PADL Software Pty Ltd.
   3  * All rights reserved.
   4  *
   5  * Portions Copyright (c) 2019 Kungliga Tekniska Högskolan
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  *
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * 3. Neither the name of PADL Software nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #include "kdc_locl.h"
  36
  37 #include <gssapi/gssapi.h>
  38 #include <gssapi_mech.h>
  39
  40 #include <gss-preauth-protos.h>
  41 #include <gss-preauth-private.h>
  42
  43 #include "gss_preauth_authorizer_plugin.h"
  44
  45 struct gss_client_params {
  46     OM_uint32 major, minor;
  47     gss_ctx_id_t context_handle;
  48     gss_name_t initiator_name;
  49     gss_OID mech_type;
  50     gss_buffer_desc output_token;
  51     OM_uint32 flags;
  52     OM_uint32 lifetime;
  53     krb5_checksum req_body_checksum;
  54     krb5_data pac_data;
  55 };
  56
  57 static void
  58 pa_gss_display_status(astgs_request_t r,
  59                       OM_uint32 major,
  60                       OM_uint32 minor,
  61                       gss_client_params *gcp,
  62                       const char *msg);
  63
  64 static void
  65 pa_gss_display_name(gss_name_t name,
  66                     gss_buffer_t namebuf,
  67                     gss_const_buffer_t *namebuf_p);
  68
  69 /*
  70  * Create a checksum over KDC-REQ-BODY (without the nonce), used to
  71  * assert the request is invariant within the preauth conversation.
  72  */
  73 static krb5_error_code
  74 pa_gss_create_req_body_checksum(astgs_request_t r,
  75                                 krb5_checksum *checksum)
  76 {
  77     krb5_error_code ret;
  78     KDC_REQ_BODY b = r->req.req_body;
  79     krb5_data data;
  80     size_t size;
  81
  82     b.nonce = 0;
  83
  84     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, data.data, data.length, &b, &size, ret);
  85     heim_assert(ret || data.length,
  86                 "internal asn1 encoder error");
  87
  88     ret = krb5_create_checksum(r->context, NULL, 0, CKSUMTYPE_SHA256,
  89                                data.data, data.length, checksum);
  90     krb5_data_free(&data);
  91
  92     return ret;
  93 }
  94
  95 /*
  96  * Verify a checksum over KDC-REQ-BODY (without the nonce), used to
  97  * assert the request is invariant within the preauth conversation.
  98  */
  99 static krb5_error_code
 100 pa_gss_verify_req_body_checksum(astgs_request_t r,
 101                                 krb5_checksum *checksum)
 102 {
 103     krb5_error_code ret;
 104     KDC_REQ_BODY b = r->req.req_body;
 105     krb5_data data;
 106     size_t size;
 107
 108     b.nonce = 0;
 109
 110     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, data.data, data.length, &b, &size, ret);
 111     heim_assert(ret || data.length,
 112                 "internal asn1 encoder error");
 113
 114     ret = _kdc_verify_checksum(r->context, NULL, 0, &data, checksum);
 115     krb5_data_free(&data);
 116
 117     return ret;
 118 }
 119
 120 /*
 121  * Decode the FX-COOKIE context state, consisting of the exported
 122  * GSS context token concatenated with the checksum of the initial
 123  * KDC-REQ-BODY.
 124  */
 125 static krb5_error_code
 126 pa_gss_decode_context_state(astgs_request_t r,
 127                             const krb5_data *state,
 128                             gss_buffer_t sec_context_token,
 129                             krb5_checksum *req_body_checksum)
 130 {
 131     krb5_error_code ret;
 132     krb5_storage *sp;
 133     size_t cksumsize;
 134     krb5_data data;
 135
 136     memset(req_body_checksum, 0, sizeof(*req_body_checksum));
 137     sec_context_token->length = 0;
 138     sec_context_token->value = NULL;
 139
 140     krb5_data_zero(&data);
 141
 142     sp = krb5_storage_from_readonly_mem(state->data, state->length);
 143     if (sp == NULL) {
 144         ret = krb5_enomem(r->context);
 145         goto out;
 146     }
 147
 148     krb5_storage_set_eof_code(sp, KRB5_BAD_MSIZE);
 149     krb5_storage_set_byteorder(sp, KRB5_STORAGE_BYTEORDER_PACKED);
 150
 151     ret = krb5_ret_data(sp, &data);
 152     if (ret)
 153         goto out;
 154
 155     ret = krb5_ret_int32(sp, &req_body_checksum->cksumtype);
 156     if (ret)
 157         goto out;
 158
 159     if (req_body_checksum->cksumtype == CKSUMTYPE_NONE ||
 160         krb5_checksum_is_keyed(r->context, req_body_checksum->cksumtype)) {
 161         ret = KRB5KDC_ERR_SUMTYPE_NOSUPP;
 162         goto out;
 163     }
 164
 165     ret = krb5_checksumsize(r->context, req_body_checksum->cksumtype,
 166                             &cksumsize);
 167     if (ret)
 168         goto out;
 169
 170     req_body_checksum->checksum.data = malloc(cksumsize);
 171     if (req_body_checksum->checksum.data == NULL) {
 172         ret = krb5_enomem(r->context);
 173         goto out;
 174     }
 175
 176     if (krb5_storage_read(sp, req_body_checksum->checksum.data,
 177                           cksumsize) != cksumsize) {
 178         ret = KRB5_BAD_MSIZE;
 179         goto out;
 180     }
 181
 182     req_body_checksum->checksum.length = cksumsize;
 183
 184     _krb5_gss_data_to_buffer(&data, sec_context_token);
 185
 186 out:
 187     if (ret) {
 188         krb5_data_free(&data);
 189         free_Checksum(req_body_checksum);
 190         memset(req_body_checksum, 0, sizeof(*req_body_checksum));
 191     }
 192     krb5_storage_free(sp);
 193
 194     return ret;
 195 }
 196
 197 /*
 198  * Deserialize a GSS-API security context from the FAST cookie.
 199  */
 200 static krb5_error_code
 201 pa_gss_get_context_state(astgs_request_t r,
 202                          gss_client_params *gcp)
 203 {
 204     int idx = 0;
 205     PA_DATA *fast_pa;
 206     krb5_error_code ret;
 207
 208     OM_uint32 major, minor;
 209     gss_buffer_desc sec_context_token;
 210
 211     fast_pa = krb5_find_padata(r->fast.fast_state.val,
 212                                r->fast.fast_state.len,
 213                                KRB5_PADATA_GSS, &idx);
 214     if (fast_pa == NULL)
 215         return 0;
 216
 217     ret = pa_gss_decode_context_state(r, &fast_pa->padata_value,
 218                                       &sec_context_token,
 219                                       &gcp->req_body_checksum);
 220     if (ret)
 221         return ret;
 222
 223     ret = pa_gss_verify_req_body_checksum(r, &gcp->req_body_checksum);
 224     if (ret) {
 225         gss_release_buffer(&minor, &sec_context_token);
 226         return ret;
 227     }
 228
 229     major = gss_import_sec_context(&minor, &sec_context_token,
 230                                    &gcp->context_handle);
 231     if (GSS_ERROR(major)) {
 232         pa_gss_display_status(r, major, minor, gcp,
 233                               "Failed to import GSS pre-authentication context");
 234         ret = _krb5_gss_map_error(major, minor);
 235     } else
 236         ret = 0;
 237
 238     gss_release_buffer(&minor, &sec_context_token);
 239
 240     return ret;
 241 }
 242
 243 /*
 244  * Encode the FX-COOKIE context state, consisting of the exported
 245  * GSS context token concatenated with the checksum of the initial
 246  * KDC-REQ-BODY.
 247  */
 248 static krb5_error_code
 249 pa_gss_encode_context_state(astgs_request_t r,
 250                             gss_const_buffer_t sec_context_token,
 251                             const krb5_checksum *req_body_checksum,
 252                             krb5_data *state)
 253 {
 254     krb5_error_code ret;
 255     krb5_storage *sp;
 256     krb5_data data;
 257
 258     krb5_data_zero(state);
 259
 260     sp = krb5_storage_emem();
 261     if (sp == NULL) {
 262         ret = krb5_enomem(r->context);
 263         goto out;
 264     }
 265
 266     krb5_storage_set_byteorder(sp, KRB5_STORAGE_BYTEORDER_PACKED);
 267
 268     _krb5_gss_buffer_to_data(sec_context_token, &data);
 269
 270     ret = krb5_store_data(sp, data);
 271     if (ret)
 272         goto out;
 273
 274     ret = krb5_store_int32(sp, req_body_checksum->cksumtype);
 275     if (ret)
 276         goto out;
 277
 278     ret = krb5_store_bytes(sp, req_body_checksum->checksum.data,
 279                            req_body_checksum->checksum.length);
 280     if (ret)
 281         goto out;
 282
 283     ret = krb5_storage_to_data(sp, state);
 284     if (ret)
 285         goto out;
 286
 287 out:
 288     krb5_storage_free(sp);
 289
 290     return ret;
 291 }
 292
 293 /*
 294  * Serialize a GSS-API security context into a FAST cookie.
 295  */
 296 static krb5_error_code
 297 pa_gss_set_context_state(astgs_request_t r,
 298                          gss_client_params *gcp)
 299 {
 300     krb5_error_code ret;
 301     PA_DATA *fast_pa;
 302     int idx = 0;
 303     krb5_data state;
 304
 305     OM_uint32 major, minor;
 306     gss_buffer_desc sec_context_token = GSS_C_EMPTY_BUFFER;
 307
 308     /*
 309      * On second and subsequent responses, we can recycle the checksum
 310      * from the request as it is validated and invariant. This saves
 311      * re-encoding the request body again.
 312      */
 313     if (gcp->req_body_checksum.cksumtype == CKSUMTYPE_NONE) {
 314         ret = pa_gss_create_req_body_checksum(r, &gcp->req_body_checksum);
 315         if (ret)
 316             return ret;
 317     }
 318
 319     major = gss_export_sec_context(&minor, &gcp->context_handle,
 320                                    &sec_context_token);
 321     if (GSS_ERROR(major)) {
 322         pa_gss_display_status(r, major, minor, gcp,
 323                               "Failed to export GSS pre-authentication context");
 324         return _krb5_gss_map_error(major, minor);
 325     }
 326
 327     ret = pa_gss_encode_context_state(r, &sec_context_token,
 328                                       &gcp->req_body_checksum, &state);
 329     gss_release_buffer(&minor, &sec_context_token);
 330     if (ret)
 331         return ret;
 332
 333     fast_pa = krb5_find_padata(r->fast.fast_state.val,
 334                                r->fast.fast_state.len,
 335                                KRB5_PADATA_GSS, &idx);
 336     if (fast_pa) {
 337         krb5_data_free(&fast_pa->padata_value);
 338         fast_pa->padata_value = state;
 339     } else {
 340         ret = krb5_padata_add(r->context, &r->fast.fast_state,
 341                               KRB5_PADATA_GSS,
 342                               state.data, state.length);
 343         if (ret)
 344             krb5_data_free(&state);
 345     }
 346
 347     return ret;
 348 }
 349
 350 static krb5_error_code
 351 pa_gss_acquire_acceptor_cred(astgs_request_t r,
 352                              gss_client_params *gcp,
 353                              gss_cred_id_t *cred)
 354 {
 355     krb5_error_code ret;
 356     krb5_principal tgs_name;
 357
 358     OM_uint32 major, minor;
 359     gss_name_t target_name = GSS_C_NO_NAME;
 360     gss_buffer_desc display_name = GSS_C_EMPTY_BUFFER;
 361     gss_const_buffer_t display_name_p;
 362
 363     *cred = GSS_C_NO_CREDENTIAL;
 364
 365     ret = krb5_make_principal(r->context, &tgs_name, r->req.req_body.realm,
 366                               KRB5_TGS_NAME, r->req.req_body.realm, NULL);
 367     if (ret)
 368         return ret;
 369
 370     ret = _krb5_gss_pa_unparse_name(r->context, tgs_name, &target_name);
 371     krb5_free_principal(r->context, tgs_name);
 372     if (ret)
 373         return ret;
 374
 375     pa_gss_display_name(target_name, &display_name, &display_name_p);
 376
 377     kdc_log(r->context, r->config, 4,
 378             "Acquiring GSS acceptor credential for %.*s",
 379             (int)display_name_p->length, (char *)display_name_p->value);
 380
 381     major = gss_acquire_cred(&minor, target_name, GSS_C_INDEFINITE,
 382                              r->config->gss_mechanisms_allowed,
 383                              GSS_C_ACCEPT, cred, NULL, NULL);
 384     ret = _krb5_gss_map_error(major, minor);
 385
 386     if (ret)
 387         pa_gss_display_status(r, major, minor, gcp,
 388                               "Failed to acquire GSS acceptor credential");
 389
 390     gss_release_buffer(&minor, &display_name);
 391     gss_release_name(&minor, &target_name);
 392
 393     return ret;
 394 }
 395
 396 krb5_error_code
 397 _kdc_gss_rd_padata(astgs_request_t r,
 398                    const PA_DATA *pa,
 399                    gss_client_params **pgcp,
 400                    int *open)
 401 {
 402     krb5_error_code ret;
 403
 404     OM_uint32 minor;
 405     gss_client_params *gcp = NULL;
 406     gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
 407     gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
 408     struct gss_channel_bindings_struct cb;
 409
 410     memset(&cb, 0, sizeof(cb));
 411
 412     *pgcp = NULL;
 413
 414     if (!r->config->enable_gss_preauth) {
 415         ret = KRB5KDC_ERR_POLICY;
 416         goto out;
 417     }
 418
 419     if (pa->padata_value.length == 0) {
 420         ret = KRB5KDC_ERR_PREAUTH_FAILED;
 421         goto out;
 422     }
 423
 424     gcp = calloc(1, sizeof(*gcp));
 425     if (gcp == NULL) {
 426         ret = krb5_enomem(r->context);
 427         goto out;
 428     }
 429
 430     /* errors are fast fail until gss_accept_sec_context() is called */
 431     gcp->major = GSS_S_NO_CONTEXT;
 432
 433     ret = pa_gss_get_context_state(r, gcp);
 434     if (ret)
 435         goto out;
 436
 437     ret = pa_gss_acquire_acceptor_cred(r, gcp, &cred);
 438     if (ret)
 439         goto out;
 440
 441     _krb5_gss_data_to_buffer(&pa->padata_value, &input_token);
 442     _krb5_gss_data_to_buffer(&r->req.req_body._save, &cb.application_data);
 443
 444     gcp->major = gss_accept_sec_context(&gcp->minor,
 445                                         &gcp->context_handle,
 446                                         cred,
 447                                         &input_token,
 448                                         &cb,
 449                                         &gcp->initiator_name,
 450                                         &gcp->mech_type,
 451                                         &gcp->output_token,
 452                                         &gcp->flags,
 453                                         &gcp->lifetime,
 454                                         NULL); /* delegated_cred_handle */
 455
 456     ret = _krb5_gss_map_error(gcp->major, gcp->minor);
 457
 458     if (GSS_ERROR(gcp->major)) {
 459         pa_gss_display_status(r, gcp->major, gcp->minor, gcp,
 460                               "Failed to accept GSS security context");
 461     } else if ((gcp->flags & GSS_C_ANON_FLAG) && !_kdc_is_anon_request(&r->req)) {
 462         kdc_log(r->context, r->config, 2,
 463                 "Anonymous GSS pre-authentication request w/o anonymous flag");
 464         ret = KRB5KDC_ERR_BADOPTION;
 465     } else
 466         *open = (gcp->major == GSS_S_COMPLETE);
 467
 468 out:
 469     gss_release_cred(&minor, &cred);
 470
 471     if (gcp && gcp->major != GSS_S_NO_CONTEXT)
 472         *pgcp = gcp;
 473     else
 474         _kdc_gss_free_client_param(r, gcp);
 475
 476     return ret;
 477 }
 478
 479 krb5_timestamp
 480 _kdc_gss_endtime(astgs_request_t r,
 481                  gss_client_params *gcp)
 482 {
 483     krb5_timestamp endtime;
 484
 485     if (gcp->lifetime == GSS_C_INDEFINITE)
 486         endtime = 0;
 487     else
 488         endtime = kdc_time + gcp->lifetime;
 489
 490     kdc_log(r->context, r->config, 10,
 491             "GSS pre-authentication endtime is %ld", endtime);
 492
 493     return endtime;
 494 }
 495
 496 struct pa_gss_authorize_plugin_ctx {
 497     astgs_request_t r;
 498     struct gss_client_params *gcp;
 499     krb5_boolean authorized;
 500     krb5_principal initiator_princ;
 501     krb5_data pac_data;
 502 };
 503
 504 static krb5_error_code KRB5_LIB_CALL
 505 pa_gss_authorize_cb(krb5_context context,
 506                     const void *plug,
 507                     void *plugctx,
 508                     void *userctx)
 509 {
 510     const krb5plugin_gss_preauth_authorizer_ftable *authorizer = plug;
 511     struct pa_gss_authorize_plugin_ctx *pa_gss_authorize_plugin_ctx = userctx;
 512
 513     return authorizer->authorize(plugctx,
 514                                  pa_gss_authorize_plugin_ctx->r,
 515                                  pa_gss_authorize_plugin_ctx->gcp->initiator_name,
 516                                  pa_gss_authorize_plugin_ctx->gcp->mech_type,
 517                                  pa_gss_authorize_plugin_ctx->gcp->flags,
 518                                  &pa_gss_authorize_plugin_ctx->authorized,
 519                                  &pa_gss_authorize_plugin_ctx->initiator_princ,
 520                                  &pa_gss_authorize_plugin_ctx->pac_data);
 521 }
 522
 523 static const char *plugin_deps[] = {
 524     "kdc",
 525     "hdb",
 526     "gssapi",
 527     "krb5",
 528     NULL
 529 };
 530
 531 static struct heim_plugin_data
 532 gss_preauth_authorizer_data = {
 533     "kdc",
 534     KDC_GSS_PREAUTH_AUTHORIZER,
 535     KDC_GSS_PREAUTH_AUTHORIZER_VERSION_1,
 536     plugin_deps,
 537     kdc_get_instance
 538 };
 539
 540 static krb5_error_code
 541 pa_gss_authorize_plugin(astgs_request_t r,
 542                         struct gss_client_params *gcp,
 543                         gss_const_buffer_t display_name,
 544                         krb5_boolean *authorized,
 545                         krb5_principal *initiator_princ,
 546                         krb5_data *pac_data)
 547 {
 548     krb5_error_code ret;
 549     struct pa_gss_authorize_plugin_ctx ctx;
 550
 551     ctx.r = r;
 552     ctx.gcp = gcp;
 553     ctx.authorized = 0;
 554     ctx.initiator_princ = NULL;
 555     krb5_data_zero(&ctx.pac_data);
 556
 557     krb5_clear_error_message(r->context);
 558     ret = _krb5_plugin_run_f(r->context, &gss_preauth_authorizer_data,
 559                              0, &ctx, pa_gss_authorize_cb);
 560
 561     if (ret != KRB5_PLUGIN_NO_HANDLE) {
 562         const char *msg = krb5_get_error_message(r->context, ret);
 563
 564         kdc_log(r->context, r->config, 7,
 565                 "GSS authz plugin %sauthorize%s %s initiator %.*s: %s",
 566                 ctx.authorized ? "" : "did not " ,
 567                 ctx.authorized ? "d" : "",
 568                 gss_oid_to_name(gcp->mech_type),
 569                 (int)display_name->length, (char *)display_name->value,
 570                 msg);
 571         krb5_free_error_message(r->context, msg);
 572     }
 573
 574     *authorized = ctx.authorized;
 575     *initiator_princ = ctx.initiator_princ;
 576     *pac_data = ctx.pac_data;
 577
 578     return ret;
 579 }
 580
 581 static krb5_error_code
 582 pa_gss_authorize_default(astgs_request_t r,
 583                          struct gss_client_params *gcp,
 584                          gss_const_buffer_t display_name,
 585                          krb5_boolean *authorized,
 586                          krb5_principal *initiator_princ,
 587                          krb5_data *pac_data)
 588 {
 589     krb5_error_code ret;
 590     krb5_principal principal;
 591     krb5_const_realm realm = r->server->entry.principal->realm;
 592     int flags = 0, cross_realm_allowed = 0, unauth_anon;
 593
 594     /*
 595      * gss_cross_realm_mechanisms_allowed is a list of GSS-API mechanisms
 596      * that are allowed to map directly to Kerberos principals in any
 597      * realm. If the authenticating mechanism is not on the list, then
 598      * the initiator will be mapped to an enterprise principal in the
 599      * service realm. This is useful to stop synthetic principals in
 600      * foreign realms being conflated with true cross-realm principals.
 601      */
 602     if (r->config->gss_cross_realm_mechanisms_allowed) {
 603         OM_uint32 minor;
 604
 605         gss_test_oid_set_member(&minor, gcp->mech_type,
 606                                 r->config->gss_cross_realm_mechanisms_allowed,
 607                                 &cross_realm_allowed);
 608     }
 609
 610     kdc_log(r->context, r->config, 10,
 611             "Initiator %.*s will be mapped to %s",
 612             (int)display_name->length, (char *)display_name->value,
 613             cross_realm_allowed ? "nt-principal" : "nt-enterprise-principal");
 614
 615     if (!cross_realm_allowed)
 616         flags |= KRB5_PRINCIPAL_PARSE_ENTERPRISE | KRB5_PRINCIPAL_PARSE_NO_REALM;
 617
 618     ret = _krb5_gss_pa_parse_name(r->context, gcp->initiator_name,
 619                                   flags, &principal);
 620     if (ret) {
 621         const char *msg = krb5_get_error_message(r->context, ret);
 622
 623         kdc_log(r->context, r->config, 2,
 624                 "Failed to parse %s initiator name %.*s: %s",
 625                 gss_oid_to_name(gcp->mech_type),
 626                 (int)display_name->length, (char *)display_name->value, msg);
 627         krb5_free_error_message(r->context, msg);
 628
 629         return ret;
 630     }
 631
 632     /*
 633      * GSS_C_ANON_FLAG indicates the client requested anonymous authentication
 634      * (it is validated against the request-anonymous flag).
 635      *
 636      * _kdc_is_anonymous_pkinit() returns TRUE if the principal contains both
 637      * the well known anonymous name and realm.
 638      */
 639     unauth_anon = (gcp->flags & GSS_C_ANON_FLAG) &&
 640         _kdc_is_anonymous_pkinit(r->context, principal);
 641
 642     /*
 643      * Always use the anonymous entry created in our HDB, i.e. with the local
 644      * realm, for authorizing anonymous requests. This matches PKINIT behavior
 645      * as anonymous PKINIT requests include the KDC realm in the request.
 646      */
 647     if (unauth_anon || (flags & KRB5_PRINCIPAL_PARSE_ENTERPRISE)) {
 648         ret = krb5_principal_set_realm(r->context, principal, realm);
 649         if (ret) {
 650             krb5_free_principal(r->context, principal);
 651             return ret;
 652         }
 653     }
 654
 655     if (unauth_anon) {
 656         /*
 657          * Special case to avoid changing _kdc_as_rep(). If the initiator is
 658          * the unauthenticated anonymous principal, r->client_princ also needs
 659          * to be set in order to force the AS-REP realm to be set to the well-
 660          * known anonymous identity. This is because (unlike anonymous PKINIT)
 661          * we only require the anonymous flag, not the anonymous name, in the
 662          * client AS-REQ.
 663          */
 664         krb5_principal anon_princ;
 665
 666         ret = krb5_copy_principal(r->context, principal, &anon_princ);
 667         if (ret)
 668             return ret;
 669
 670         krb5_free_principal(r->context, r->client_princ);
 671         r->client_princ = anon_princ;
 672     }
 673
 674     *authorized = TRUE;
 675     *initiator_princ = principal;
 676
 677     return 0;
 678 }
 679
 680 krb5_error_code
 681 _kdc_gss_check_client(astgs_request_t r,
 682                       gss_client_params *gcp,
 683                       char **client_name)
 684 {
 685     krb5_error_code ret;
 686     krb5_principal initiator_princ = NULL;
 687     hdb_entry_ex *initiator = NULL;
 688     krb5_boolean authorized = FALSE;
 689     krb5_data pac_data;
 690
 691     OM_uint32 minor;
 692     gss_buffer_desc display_name = GSS_C_EMPTY_BUFFER;
 693     gss_const_buffer_t display_name_p;
 694
 695     *client_name = NULL;
 696     krb5_data_zero(&pac_data);
 697
 698     pa_gss_display_name(gcp->initiator_name, &display_name, &display_name_p);
 699
 700     /*
 701      * If no plugins handled the authorization request, then all clients
 702      * are authorized as the directly corresponding Kerberos principal.
 703      */
 704     ret = pa_gss_authorize_plugin(r, gcp, display_name_p,
 705                                   &authorized, &initiator_princ, &pac_data);
 706     if (ret == KRB5_PLUGIN_NO_HANDLE)
 707         ret = pa_gss_authorize_default(r, gcp, display_name_p,
 708                                        &authorized, &initiator_princ, &pac_data);
 709     if (ret == 0 && !authorized)
 710         ret = KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
 711     if (ret)
 712         goto out;
 713
 714     ret = krb5_unparse_name(r->context, initiator_princ, client_name);
 715     if (ret)
 716         goto out;
 717
 718     kdc_log(r->context, r->config, 4,
 719             "Mapped GSS %s initiator %.*s to principal %s",
 720             gss_oid_to_name(gcp->mech_type),
 721             (int)display_name_p->length, (char *)display_name_p->value,
 722             *client_name);
 723
 724     ret = _kdc_db_fetch(r->context,
 725                         r->config,
 726                         initiator_princ,
 727                         HDB_F_FOR_AS_REQ | HDB_F_GET_CLIENT |
 728                              HDB_F_CANON | HDB_F_SYNTHETIC_OK,
 729                         NULL,
 730                         &r->clientdb,
 731                         &initiator);
 732     if (ret) {
 733         const char *msg = krb5_get_error_message(r->context, ret);
 734
 735         kdc_log(r->context, r->config, 4, "UNKNOWN -- %s: %s",
 736                 *client_name, msg);
 737         krb5_free_error_message(r->context, msg);
 738
 739         goto out;
 740     }
 741
 742     /*
 743      * If the AS-REQ client name was the well-known federated name, then
 744      * replace the client name with the initiator name. Otherwise, the
 745      * two principals must match, noting that GSS pre-authentication is
 746      * for authentication, not general purpose impersonation.
 747      */
 748     if (krb5_principal_is_federated(r->context, r->client->entry.principal)) {
 749         initiator->entry.flags.force_canonicalize = 1;
 750
 751         _kdc_free_ent(r->context, r->client);
 752         r->client = initiator;
 753         initiator = NULL;
 754     } else if (!krb5_principal_compare(r->context,
 755                                        r->client->entry.principal,
 756                                        initiator->entry.principal)) {
 757         kdc_log(r->context, r->config, 2,
 758                 "GSS %s initiator %.*s does not match principal %s",
 759                 gss_oid_to_name(gcp->mech_type),
 760                 (int)display_name_p->length, (char *)display_name_p->value,
 761                 r->cname);
 762         ret = KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
 763         goto out;
 764     }
 765
 766     gcp->pac_data = pac_data;
 767     krb5_data_zero(&pac_data);
 768
 769 out:
 770     krb5_free_principal(r->context, initiator_princ);
 771     if (initiator)
 772         _kdc_free_ent(r->context, initiator);
 773     krb5_data_free(&pac_data);
 774     gss_release_buffer(&minor, &display_name);
 775
 776     return ret;
 777 }
 778
 779 krb5_error_code
 780 _kdc_gss_mk_pa_reply(astgs_request_t r,
 781                      gss_client_params *gcp)
 782 {
 783     krb5_error_code ret;
 784     const KDC_REQ *req = &r->req;
 785
 786     if (gcp->major == GSS_S_COMPLETE) {
 787         krb5_enctype enctype;
 788         uint32_t kfe = 0;
 789         krb5_keyblock *reply_key = NULL;
 790
 791         if (krb5_principal_is_krbtgt(r->context, r->server_princ))
 792             kfe |= KFE_IS_TGS;
 793
 794         ret = _kdc_find_etype(r, kfe, req->req_body.etype.val,
 795                               req->req_body.etype.len, &enctype, NULL, NULL);
 796         if (ret)
 797             return ret;
 798
 799         ret = _krb5_gss_pa_derive_key(r->context, gcp->context_handle,
 800                                       req->req_body.nonce,
 801                                       enctype, &reply_key);
 802         if (ret) {
 803             kdc_log(r->context, r->config, 10,
 804                     "Failed to derive GSS reply key: %d", ret);
 805             return ret;
 806         }
 807
 808         krb5_free_keyblock_contents(r->context, &r->reply_key);
 809         r->reply_key = *reply_key;
 810         free(reply_key);
 811     } else if (gcp->major == GSS_S_CONTINUE_NEEDED) {
 812         ret = pa_gss_set_context_state(r, gcp);
 813         if (ret)
 814             return ret;
 815     }
 816
 817     /* only return padata in error case if we have an error token */
 818     if (!GSS_ERROR(gcp->major) || gcp->output_token.length) {
 819         ret = krb5_padata_add(r->context, r->rep.padata, KRB5_PADATA_GSS,
 820                               gcp->output_token.value, gcp->output_token.length);
 821         if (ret)
 822             return ret;
 823
 824         /* token is now owned by r->rep.padata */
 825         gcp->output_token.length = 0;
 826         gcp->output_token.value = NULL;
 827     }
 828
 829     if (gcp->major == GSS_S_CONTINUE_NEEDED)
 830         ret = KRB5_KDC_ERR_MORE_PREAUTH_DATA_REQUIRED;
 831     else
 832         ret = _krb5_gss_map_error(gcp->major, gcp->minor);
 833
 834     return ret;
 835 }
 836
 837 krb5_error_code
 838 _kdc_gss_mk_composite_name_ad(astgs_request_t r,
 839                               gss_client_params *gcp)
 840 {
 841     krb5_error_code ret;
 842     krb5_data data;
 843
 844     OM_uint32 major, minor;
 845     gss_buffer_desc namebuf = GSS_C_EMPTY_BUFFER;
 846
 847     if (!r->config->enable_gss_auth_data || (gcp->flags & GSS_C_ANON_FLAG))
 848         return 0;
 849
 850     major = gss_export_name_composite(&minor, gcp->initiator_name, &namebuf);
 851     if (major == GSS_S_COMPLETE) {
 852         _krb5_gss_buffer_to_data(&namebuf, &data);
 853
 854         ret = _kdc_tkt_add_if_relevant_ad(r->context, &r->et,
 855                                           KRB5_AUTHDATA_GSS_COMPOSITE_NAME,
 856                                           &data);
 857     } else if (major != GSS_S_UNAVAILABLE)
 858         ret = _krb5_gss_map_error(major, minor);
 859     else
 860         ret = 0;
 861
 862     gss_release_buffer(&minor, &namebuf);
 863
 864     return ret;
 865 }
 866
 867 void
 868 _kdc_gss_free_client_param(astgs_request_t r,
 869                            gss_client_params *gcp)
 870 {
 871     OM_uint32 minor;
 872
 873     if (gcp == NULL)
 874         return;
 875
 876     gss_delete_sec_context(&minor, &gcp->context_handle, GSS_C_NO_BUFFER);
 877     gss_release_name(&minor, &gcp->initiator_name);
 878     gss_release_buffer(&minor, &gcp->output_token);
 879     free_Checksum(&gcp->req_body_checksum);
 880     krb5_data_free(&gcp->pac_data);
 881     memset(gcp, 0, sizeof(*gcp));
 882     free(gcp);
 883 }
 884
 885 krb5_error_code
 886 _kdc_gss_get_mechanism_config(krb5_context context,
 887                               const char *section,
 888                               const char *key,
 889                               gss_OID_set *oidsp)
 890 {
 891     krb5_error_code ret;
 892     char **mechs, **mechp;
 893
 894     gss_OID_set oids = GSS_C_NO_OID_SET;
 895     OM_uint32 major, minor;
 896
 897     mechs = krb5_config_get_strings(context, NULL, section, key, NULL);
 898     if (mechs == NULL)
 899         return 0;
 900
 901     major = gss_create_empty_oid_set(&minor, &oids);
 902     if (GSS_ERROR(major)) {
 903         krb5_config_free_strings(mechs);
 904         return _krb5_gss_map_error(major, minor);
 905     }
 906
 907     for (mechp = mechs; *mechp; mechp++) {
 908         gss_OID oid = gss_name_to_oid(*mechp);
 909         if (oid == GSS_C_NO_OID)
 910             continue;
 911
 912         major = gss_add_oid_set_member(&minor, oid, &oids);
 913         if (GSS_ERROR(major))
 914             break;
 915     }
 916
 917     ret = _krb5_gss_map_error(major, minor);
 918     if (ret == 0)
 919         *oidsp = oids;
 920     else
 921         gss_release_oid_set(&minor, &oids);
 922
 923     krb5_config_free_strings(mechs);
 924
 925     return ret;
 926 }
 927
 928 static void
 929 pa_gss_display_status(astgs_request_t r,
 930                       OM_uint32 major,
 931                       OM_uint32 minor,
 932                       gss_client_params *gcp,
 933                       const char *msg)
 934 {
 935     krb5_error_code ret = _krb5_gss_map_error(major, minor);
 936     gss_buffer_desc buf = GSS_C_EMPTY_BUFFER;
 937     OM_uint32 dmaj, dmin;
 938     OM_uint32 more = 0;
 939     char *gmmsg = NULL;
 940     char *gmsg = NULL;
 941     char *s = NULL;
 942
 943     do {
 944         gss_release_buffer(&dmin, &buf);
 945         dmaj = gss_display_status(&dmin, major, GSS_C_GSS_CODE, GSS_C_NO_OID,
 946                                   &more, &buf);
 947         if (GSS_ERROR(dmaj) ||
 948             buf.length >= INT_MAX ||
 949             asprintf(&s, "%s%s%.*s", gmsg ? gmsg : "", gmsg ? ": " : "",
 950                      (int)buf.length, (char *)buf.value) == -1 ||
 951             s == NULL) {
 952             free(gmsg);
 953             gmsg = NULL;
 954             break;
 955         }
 956         gmsg = s;
 957         s = NULL;
 958     } while (!GSS_ERROR(dmaj) && more);
 959
 960     if (gcp->mech_type != GSS_C_NO_OID) {
 961         do {
 962             gss_release_buffer(&dmin, &buf);
 963             dmaj = gss_display_status(&dmin, major, GSS_C_MECH_CODE,
 964                                       gcp->mech_type, &more, &buf);
 965             if (GSS_ERROR(dmaj) ||
 966                 asprintf(&s, "%s%s%.*s", gmmsg ? gmmsg : "", gmmsg ? ": " : "",
 967                          (int)buf.length, (char *)buf.value) == -1 ||
 968                 s == NULL) {
 969                 free(gmmsg);
 970                 gmmsg = NULL;
 971                 break;
 972             }
 973             gmmsg = s;
 974             s = NULL;
 975         } while (!GSS_ERROR(dmaj) && more);
 976     }
 977
 978     if (gmsg == NULL)
 979         krb5_set_error_message(r->context, ENOMEM,
 980                                "Error displaying GSS-API status");
 981     else
 982         krb5_set_error_message(r->context, ret, "%s%s%s%s", gmsg,
 983                                gmmsg ? " (" : "", gmmsg ? gmmsg : "",
 984                                gmmsg ? ")" : "");
 985     krb5_prepend_error_message(r->context, ret, "%s", msg);
 986
 987     kdc_log(r->context, r->config, 1,
 988             "%s: %s%s%s%s",
 989             msg, gmsg, gmmsg ? " (" : "", gmmsg ? gmmsg : "",
 990             gmmsg ? ")" : "");
 991
 992     free(gmmsg);
 993     free(gmsg);
 994 }
 995
 996 static const gss_buffer_desc
 997 gss_pa_unknown_display_name = {
 998     sizeof("<unknown name>") - 1,
 999     "<unknown name>"
1000 };
1001
1002 static void
1003 pa_gss_display_name(gss_name_t name,
1004                     gss_buffer_t namebuf,
1005                     gss_const_buffer_t *namebuf_p)
1006 {
1007     OM_uint32 major, minor;
1008
1009     major = gss_display_name(&minor, name, namebuf, NULL);
1010     if (GSS_ERROR(major))
1011         *namebuf_p = &gss_pa_unknown_display_name;
1012     else
1013         *namebuf_p = namebuf;
1014 }
1015
1016 struct pa_gss_finalize_pac_plugin_ctx {
1017     astgs_request_t r;
1018     krb5_data *pac_data;
1019 };
1020
1021 static krb5_error_code KRB5_LIB_CALL
1022 pa_gss_finalize_pac_cb(krb5_context context,
1023                         const void *plug,
1024                         void *plugctx,
1025                         void *userctx)
1026 {
1027     const krb5plugin_gss_preauth_authorizer_ftable *authorizer = plug;
1028     struct pa_gss_finalize_pac_plugin_ctx *pa_gss_finalize_pac_ctx = userctx;
1029
1030     return authorizer->finalize_pac(plugctx,
1031                                     pa_gss_finalize_pac_ctx->r,
1032                                     pa_gss_finalize_pac_ctx->pac_data);
1033 }
1034
1035
1036 krb5_error_code
1037 _kdc_gss_finalize_pac(astgs_request_t r,
1038                       gss_client_params *gcp)
1039 {
1040     krb5_error_code ret;
1041     struct pa_gss_finalize_pac_plugin_ctx ctx;
1042
1043     ctx.r = r;
1044     ctx.pac_data = &gcp->pac_data;
1045
1046     krb5_clear_error_message(r->context);
1047     ret = _krb5_plugin_run_f(r->context, &gss_preauth_authorizer_data,
1048                              0, &ctx, pa_gss_finalize_pac_cb);
1049
1050     if (ret == KRB5_PLUGIN_NO_HANDLE)
1051         ret = 0;
1052
1053     return ret;
1054 }